When a kube-apiserver-guard pod is evicted due to preemption, it just stays in "Completed" status forever, regardless of whether the situation that caused the eviction is already gone.

With the pod stuck in "Completed" state, the corresponding PDB has the false impression that the kube-apiserver pod in that node is not healthy and unnecessarily halts node drains that should be allowed.

Manually deleting the "Completed" pod is a workaround. However, this is something the kube-apiserver-operator should do automatically, users should not be expected to know OCP internals in this deep so they can do themselves.

4.13.9

Sometimes (at random)

1. Wait for some situation where kube-apiserver-guard pod is preempted.
2.
3.

kube-apiserver-guard pod should be eventually restarted and run as normal, once the node allows it, without manual workaround.

kube-apiserver-guard pod stays in "Completed" state forever unless manual workaround is applied.

A similar situation has been also found with the etcd-quorum-guard pod, but we have better data for this one. Once the fix for this bug is on track, I may open second bug to the etcd team so they can apply a similar fix.